The whistleblower exposing the Department of Health's secret dossiers

When he first saw it, Shane Corr had to get up from his desk.

He went downstairs, left the building, and sat on Dublin's Baggot St.

He spent an hour outside the newly redeveloped Miesian Plaza – trying to make sense of it all.

During his long spell working as an auditor with the body that polices State spending, the Comptroller and Auditor General, he had been exposed to some sensitive, highly confidential material.

But this was different.

Now he was with the Department of Health – and what he had discovered had far graver consequences. It was not just wasting money or bad accounting.

"I had never been faced with anything like this before – with this emotional content," Mr Corr told RTÉ Investigates.

He decided that he would have to put his emotional response to one side so that he could make notes – and erase all doubt in his mind about what he had discovered.

He looked for further documents to back up what he saw. He examined and tested his findings, as he would have done during any other audit.

But nothing he found could override his initial gut instinct – that what he had seen was not right.

In spreadsheets and files that could be accessed by anybody working in the department's Social Care division, there was sensitive medical and educational information about children with autism who were involved in long-dormant court cases against the Department of Health.

Mr Corr later concluded that the files were built and maintained over several years without the knowledge or consent of parents – and were used to aid the Department of Health's legal strategy in the cases.

"Parents don't know it's there and the children don't know it's there," he said.

"The only way I could walk away with a clear conscience was when those parents and those children knew what I knew."

Mr Corr did what he felt he was supposed to do – he followed the procedures set out in the Protected Disclosures Act.

He wrote a letter to the Secretary General of the Department outlining what he had discovered, hoping this would trigger the change he felt was necessary.

But a year has passed and parents are none the wiser.

Now, he has decided to tell his story to RTÉ Investigates.

What Mr Corr had seen on his computer that day related to a group of children who had been diagnosed with autism and, in the early to mid-2000s, had seen individual High Court cases taken in their name by parents fighting for access to appropriate services and education.

At the time, other cases were making high-profile journeys to the Supreme Court to ensure children with autism could not be denied their right to a proper education.

It appears that, in most cases, the parents would have incurred significant legal fees because solicitors acting on their behalf prepared detailed case files to build a case to take to court and this incurred instruction fees.

But once the cases got lodged in the High Court, the proceedings never moved on. 

In many cases, the Department or other State bodies agreed to provide some services, reducing the urgency of those legal cases.

But this did not happen in all cases: The Department of Health, the Heath Service Executive and the Department of Education had settled more than a hundred cases between 1996 and 2016, at a cost of more than €11m.

Many other cases stayed on the books – at least a further four dozen. They were never heard in court, subject to judgement, withdrawn or settled. Court records indicate that, in all respects, they were dormant.

But Mr Corr discovered that activity in the background had not stopped.

"I saw something that, frankly, I can only describe as shocking. I saw an e-mail from an official at the Department of Health to a doctor who is working for the HSE, explaining that they were involved in litigation with one of her patients and asking for information from this doctor."

This came as part of a template letter issued to HSE doctors and professionals across the country, which explicitly asked that neither the family nor their solicitors are contacted about the request.

The correspondence indicated a family, whose case had been dormant for 10 years, had attended private consultations with a psychiatrist for the purposes of getting medical help. They had shared information about themselves and their home situation during the sessions.

But the Department of Health had reached across to the HSE and contacted the doctor directly to look for details of what was happening with the family.

The doctor asked the Department if the patient or parents had been informed about the information request.

"And the reply was 'no, we haven't informed the patient, we haven't informed the parents – and we're not going to. We don't ask for consent'," Mr Corr told RTÉ Investigates.

"This is standard practice when we're running a case, litigation case – we ring HSE units around the country and we ask for information, any information that might be helpful to the case."

A day later, after the psychiatrist had just seen the child, a lengthy clinical evaluation was sent to the Department.

It was not deleted. We know this because, three years later, Mr Corr was able to discover it simply by typing in keywords such as "litigation" or "disability" into the internal computer search facility for the Department's social care division.

"I mean, everybody goes to the doctor with the assumption that the doctor isn't going to tell somebody else about what problems you have .... I mean that has to be a given," he said.

It was not an isolated case. More searching revealed more documents – containing "every type of information on children and their siblings and their parents," he said.

"It wasn't known to the parents. It wasn't known to the children."

It was not scattered in one-off emails. It was gathered and organised in carefully formatted spreadsheets, where the original documents were summarised and updated.

"I saw several notes relating to alcoholism within the family structure. I saw notes related to siblings of the children. They weren't relevant. Every type of family information was there … whether the child is prone to violent acts towards its parents, its siblings, its teachers, its doctor," Mr Corr said. 

"Everything that you would not want to know about the family living beside you – it was there."

Much of the information was drawn from conversations with doctors. It was transcribed and logged in Excel spreadsheets and shared with the Department of Education and the HSE, he said.

Other documents he discovered helped him understand why all of this was happening. It was not being collected for the purposes of responding to something that had been raised in court – or to prepare for an imminent hearing.

It was to strategise, to understand the mindset and mood of the families – to help them figure out if it would be a good time to approach them to withdraw their legal cases.

At the right time, a family might be willing to withdraw their historic case, rather than to settle it. In this scenario, the Department would not owe the family their legal costs.

But only one side – the Department – was aware the case was still being worked on in this way.

"If you're running a litigation case, it's an extraordinary advantage if you know the mindset of the person who has entered into litigation against you," Mr Corr said.

"And there's no way any parent would give that advantage to go to the Department or the HSE. They couldn't have known that these doctors were reporting back the information."

In these types of cases, the Department of Health was usually sued alongside other State bodies who answered for different services. The HSE dealt with medical and disability supports, and the Department of Education oversaw schooling.

This meant that school records were also kept – but not just summaries. These were the actual classroom reports every student in the country could expect to get home each summer.

"As in, a child takes home its report – Maths A, Science B, you know, Irish C – and then a written note by the schoolteacher about the child. That, a copy of that. And a sequence of them."

Despite the intimate nature of the material kept, Mr Corr said it did not enjoy any special protection.

"I had my own password to get into the system, my own account," he said.

He could type in keywords such as "children" or "disabilities" and retrieve the documents. 

"I mean, they were just as available as if they had been paper documents sitting in a file beside me."

Last year, the Department of Health acted on Mr Corr's protected disclosure.

In a statement to RTÉ Investigates, it said it had appointed an expert senior counsel to examine the issues raised in the internal complaint. 

A report from this expert was delivered to the Department last November. According to the statement, the information sharing practice "has been found by an independent, expert review to be entirely lawful, proper and appropriate".

Mr Corr does not agree, but he has not seen the report. To do so, he must sign a confidentiality agreement that states that, if he discloses any details of it, he will be guilty of misconduct.

In seeking access to the report, he was reminded of his duties as a civil servant not to disclose confidential information without authorisation.

The Department of Health said it was normal practice and permitted under data protection laws for sides who are co-defendants to cooperate and share information that is required for the case.

"It is in the public interest that State parties to litigation manage those proceedings as economically and efficiently as possible," it said.

"In pursuing a well-managed, cost effective, approach to litigation in the public interest, Government Departments regularly adopt a joint strategy in defending litigation."

"Indeed, it is normal practice for defendants to litigation to co-operate and share appropriate information with each other required for obtaining legal advice and/or defending the proceedings, where they have a common interest in the issues and outcome of the proceedings," it added.

This statement was echoed by the Department of Education, which said the joint strategy was usual and necessary.

"This is essential in circumstances, as would happen frequently in cases of children with special educational needs, where the services and supports sought by the litigants are the responsibility of more than one Department or agency," it said.

"This ensures that all information held by the State parties regarding the individual litigant is provided to the Court with opportunities to provide additional information, evidence or be cross-examined if required."

The Health Service Executive also echoed the statement, adding that it took doctor-patient confidentiality seriously.

"We would not knowingly share personal information in breach of doctor/patient confidentiality or otherwise unlawfully, and we take our obligations in this regard very seriously," it said.

The Department of Health's statement said there was nothing arising from the expert report that required it to change its practices.  

Mr Corr was not prepared to move on.

The Department has since said that any civil servant who discloses confidential information without authorisation and anybody who receives it are guilty of an offence under the Official Secrets Act.

But he was still willing to speak publicly, in turn putting his career and reputation on the line.

He said that, once he gathered himself and got up from Baggot St that day, there was no chance he was going to sit back down until those he felt needed to know about this practice had been informed.

"Once I saw the piece of correspondence from the Department saying 'we're asking for information from you about a child, but we're not going to ask for consent to get it', there was no way I was ever going to let that lie," he said.

These were vulnerable people, Mr Corr said, many of whom were in desperate situations. They had brought their children to see psychologists, psychiatrists, and other doctors – and put their faith in the State.

"That faith was not rewarded," he said. "It was used against them."

Watch RTÉ Investigates: The Department, The Data & The Disclosure on RTÉ Player.